Computers are vulnerable to malicious computer code such as worms, viruses and Trojan horses. As used herein, “malicious computer code” is any code that enters a computer without an authorized user's knowledge and/or without an authorized user's consent. Malicious computer code can infect a computer by modifying an executable file, such that when the executable file is run, the malicious code executes on the computer. It is possible to analyze an executable file both before and after it is modified, in order to attempt to identify a malicious modification. However, there are many legitimate reasons why an executable file can be modified. It is often difficult to determine whether a modification is legitimate or malicious, as the differences between the two are often subtle. It is therefore desirable to be able to distinguish between a legitimate modification and a malicious modification to an executable file.
Legitimate modifications and malicious modifications do each tend to have certain characteristics. For example, most legitimate modifications insert new code somewhere in the code section of the executable file, thereby adding additional code and shifting the unchanged code to accommodate the modification. Malicious modifications rarely involve such substantive reworkings of the code section. Instead, a malicious modification will often simply append malicious code to the end of the file, and then replace a single instruction in the code section (or header) with an instruction to transfer execution to the appended malicious code. Additionally, legitimate modifications frequently substantively alter the data section of the executable file, whereas malicious modifications rarely do so. Finally, malicious modifications often include specific modifications to the executable file, such as modifying an entry point to transfer control to another location, appending content to the executable file (e.g., to the end of the data section) or altering the flags to extend execute privileges to the data section, so as to be able to execute the maliciously appended content. It would be desirable to utilize these legitimate and malicious modification characteristics to distinguish between a legitimate modification and a malicious modification to an executable file.